Deployment and integration
Define the workflow. Then price the work.
Use the free evidence tools today. Supplier Workspace is planned at €650/month excluding VAT; optional assisted setup starts from €4,950. Workspace is not on sale yet. Stamp subscriptions are a separate purchase.
Start with one supplier request, one reviewer and a measurable handover.
Proposed work must name the deliverables, responsibilities, acceptance checks, support and price in a written scope. Shared supplier profiles, team permissions and automatic reminders are planned capabilities, not included features today. The estimator is indicative; it does not book work or create a service commitment.
Answer it as a procurement or compliance department would, and the figure moves as you answer — with a line under it saying which answer moved it, and by how much. Every rate it uses is printed below. Every line shows its working. Nothing is posted until you send the scope at the last step. What we would actually do, if you send it, is laptop work: a written scope, environment keys if you already hold them, and a call if you ask. There is no factory visit, no named engineer on a plane, and no second product. If Plant covers the count, buy Plant.
◔not checkedNobody has established this number. It is arithmetic run on answers only you have seen, until you send the scope.
Indicative, for the entity you name.
—
Fill the form in and this becomes a band.
Send posts a summary to us. Download is built in this tab. The e-mail opens in your own mail program. Nothing is posted until you choose.
The rate card, so the sum can be done on paper.
| Line | Rate | Charged against |
|---|---|---|
| The deployment — once, in year one | ||
| Standing it up | €48,000 | every engagement, once. The form declines to quote it at all unless at least two of these are true: more than one country of production, more than forty supplier sites, more than a hundred product lines, more than one entity filing in its own name, more than a hundred thousand units a year, or a supply base you do not own |
| Countries of production | €14,000 | each country. Each origin is its own legality stack under Article 3(b) |
| HS headings | €9,000 | each heading after the first. A second heading is a second set of record shapes and floors |
| Product lines | €900 · €360 · €140 | the first 100, the next 900, and each one after that |
| Supplier sites | €700 · €280 · €110 | the first 50, the next 450, and each one after that |
| Supplier programme | €340 | each site, and only where the supply base is not yours to instruct |
| Trader rather than operator | × 0.6 | the whole deployment. Article 5 is a lighter obligation than Article 8 |
| Seats | €0 | nothing. You are not buying seats, at any number of them |
| The year — every year, the first one included | ||
| Filing runtime | €24,000 | a year, for each legal entity that files in its own name against its own credentials |
| The meter | 11.9c · 9.8c · 8.9c · 8.4c | a qualified stamp: the first 100,000 a year, to one million, to ten million, and above it |
| Your deadline | €0 | nothing, ever. It changes what can be in scope, never the rate |
| The shape of the total | ||
| Year one | D + Y | the deployment, plus the year |
| Each year after | D ÷ 4 + Y | a quarter of the deployment carries the configuration forward; the year is the year |
| The band printed above | −10% to +25% | around year one. It is not symmetrical, because scope found later goes up more often than it goes down, and a symmetrical band would be a flattering lie |
Indicative, and not an offer. Binding terms are in a written scope signed by both sides, and this table creates none. Every line is remote configuration of the published product — never a factory visit. It is published here so the arithmetic can be checked, argued with and taken away — including by somebody who decides on the strength of it that a €25,000 Plant year is the better purchase, which for most operators it is.
Procurement answers
Procurement answers — the format and the reader, SOC 2, ISO 27001, SSO, SLA, sub-processors, continuity Folded on purpose. The quiz above is the page.
The whole of it on one page a reviewer can hand on: the security and buying pack — architecture, data flow, sub-processors, retention and export, service limits, vulnerability contact, and the questionnaire answers as they are.
Enterprise
The format, the reader and the two edges.
The format is published.
The readable specification, the envelope text, the furniture profile and the conformance vectors are published documents, served from this site. The specification text is CC BY 4.0. The intended patent covenant remains a draft until given by the applicant; what is open and what is not is written down. Anyone can write a reader from them without asking us.
⚠ What is not given yet: a patent non-assert covenant. One is drafted and has not been reviewed by counsel, so nothing here is a patent grant and no page of ours describes one as in force. The US provisional is 64/125,042, rights not granted.
The reader runs offline.
Checking happens on the checker's own device, against the bytes in hand. It reaches no server of ours, so it cannot be metered, cannot be logged and cannot be switched off.
The free reader is /read.html: for whoever you hand a folder to, with no account, offline after the first load, and nothing leaves their device.
Both edges are third parties.
The lower edge is a drand beacon round. The upper edge is a signed RFC 3161 token from an independent authority. Neither is issued by us, and neither needs us to be readable.
A new envelope binds to a beacon round. A signed timestamp adds evidence that the committed bytes existed by its stated time; older content may appear in that envelope. The published plans sell pages, seats, a vault and, from Maker to Plant, qualified tokens. Deployment work, if agreed, is separately scoped. A recipient can check a downloaded stamp without our server.
Self-serve plans, and a scoped deployment.
The plans are bought on the plans page with a card. A deployment is scoped on this page and priced from the rate card above.
Bought with a card, by you, today.
Trial at €0, Stand at €29 (pages without the qualified allowance), Maker at €39, Studio at €199, Works at €599 a month — twelve months for the price of ten if you pay the year — and blocks of 500, 5,000, 25,000 or 100,000 qualified stamps that are bought once and never expire. They are bought in the account; no conversation is needed.
If your scope fits there, the quiz on this page says so and prints the self-serve figure beside the deployment's. The whole ladder.
Scoped, then bought.
A deployment is not a bigger allowance. It is a configuration against a defined problem: your commodities and HS headings, your countries of production and their legality stacks, your supplier sites — including the ones that do not work for you — and a filing runtime holding your Information System credentials, per legal entity.
It is priced from the scope, not by seat or by month, so this card carries no monthly figure.
What leaves, and only when you choose. The quiz prices itself in this tab. At the last step you can send the scope to us (it becomes a Lead in the CRM we operate in the EU), download the document, or open it in your own mail program. Until you press one of those, nothing is posted. The form itself still has nowhere to submit: this page is served with form-action 'none', so a browser would refuse an HTML submission. The send button is a same-origin fetch to /api/crm. Plots, stamps, desk bundles and Information System keys are never in that payload.
What the number is not. It is indicative, it is arithmetic run on your own answers, and it is not an offer. Binding terms are in a written scope, signed by both sides. Nothing on this page — not the rate card, not the band, not this sentence — creates one.
Retention, switching and penalties.
What European law says on each, with the text linked.
The horizon: EUDR. Regulation (EU) 2023/1115 requires due-diligence documentation to be retained and producible for at least five years. The obligations begin on 30 December 2026 for large and medium operators and on 30 June 2027 for micro and small ones. A statement filed in 2027 must still be readable, and its evidence still checkable, in 2032. So a reader prints, beside every stamp's bracket, the date on which that stamp stops being independently checkable by an ordinary PKI verifier — a date read from the reader's own recorded copy of the timestamp authority's certificate, never from the stamp itself, since a date a stamp carried about itself would be the stamp vouching for its own shelf — together with any renewal timestamp that extends it: a renewal the format carries beside the envelope, and one the desk issues as a side-car, so the record's identity never moves.
The exit: the Data Act. Regulation (EU) 2023/2854, applicable since 12 September 2025, requires a data-processing provider to support switching, to complete the transition in at most 30 days, and — from 12 January 2027 — to charge nothing at all for it.
Switching away. The records are sealed on your device, in a published format, and are already in your storage, so there is no export from us to schedule.
Penalties: EUDR Article 25. Article 25(2) requires member states to provide for fines whose maximum is at least 4% of total annual Union-wide turnover in the preceding financial year, increased where necessary to exceed the economic benefit gained; plus confiscation of the products, confiscation of the revenue gained from the transaction, and temporary exclusion of up to 12 months from public procurement and public funding. A member state may set its maximum higher than 4%; none may set it lower. This page does not ask for turnover, and turnover is not an input to any price on this page.
The procurement checklist, answered in public.
This is the list that usually arrives as a spreadsheet. It is answered here instead, in the four outcomes the product uses on evidence, so you can read our answers about ourselves the way a reader reads a stamp.
not refuted — nothing contradicted itnot checked — nobody has established itrefuted — we do not have itproduced — a thing exists; nothing was judged
| What procurement asks for | Outcome | What is actually true |
|---|---|---|
| Certifications and audits | ||
| SOC 2 Type II report | ✕refuted | None. We have never held one, none is commissioned and none is scheduled. Nothing on this site should be read as implying otherwise. |
| ISO/IEC 27001 certification | ✕refuted | None. No certification body has assessed us against 27001 or anything else. |
| Independent penetration-test report | ✕refuted | None commissioned. What exists instead: the format, the reader and the conformance vectors are public, so the part worth attacking can be attacked before you sign. Findings go to security@openstamps.com. |
| Customer references and case studies | ✕refuted | None to give. We would rather you check a stamp than telephone a reference: one is evidence and the other is a person we chose. |
| Security questionnaire returned privately | ✕refuted | We will not send one set of answers in private and publish another. This table is the answer; copy it into your form, and hold us to it in public. |
| Identity and access | ||
| Single sign-on with your identity provider | ◆produced | OpenID Connect, on every plan at no extra price: Continue with Google (Google Workspace) and Continue with Microsoft (Microsoft Entra ID — work and school accounts whose organisation has verified its e-mail domain with Microsoft, which is the normal case; personal Microsoft accounts too). Authorization code with PKCE, the exchange server-side, no provider script on any page; your provider's own MFA and conditional-access rules apply because your provider is what signs the person in. Single sign-on is a baseline security control, not an upsell — the position argued at sso.tax, which we agree with. |
| SAML 2.0 | ✕refuted | Not built. Okta, Entra and Google all speak OpenID Connect, which is what is built; a provider that speaks only SAML is not served today. |
| Teams: several people on one balance, roles, central billing | ◆produced | An owner on Studio or above starts a team and invites colleagues by work address; each keeps their own sign-in (their provider's MFA included), keys, journal rows and vault files, and stamps against the owner's balance under the owner's allowances. Roles: owner, admin, member. Seats are the plan's — five on Studio, fifteen on Works, forty on Mill, a hundred on Plant. One invoice, the owner's. The team's journal lists every member's stamps with who made them. |
| SCIM provisioning or directory sync | ✕refuted | Not built: members are invited by address, one at a time. The same commitment applies: it will not carry a price of its own when it exists. |
| API keys you issue and revoke yourself | ◆produced | Any account makes one, in the account page, with no plan condition. Only a SHA-256 hash of the key is stored, never the key; a revoked key keeps its row as the trail. |
| Seat limits enforced by the software | ◔not checked | Seats are printed on the plan and are not policed by the code. A deployment does not count them at all — they are not a line on its quote and not a term in its scope — so nothing here turns on it; it is written down because it is true of the self-serve ladder below you, whose seat numbers are honour-system. |
| Support and service levels | ||
| Named account manager or support contact | ✕refuted | None, deliberately. There is nobody to be escalated to because there is no queue you are standing in: what you would have asked is published, and what is not published is not privately better. |
| Support response-time commitment | ✕refuted | None, on any plan. pilot@openstamps.com and security@openstamps.com are read by people; neither carries a promise about when. |
| Uptime SLA with service credits | ✕refuted | None promised, on any plan, and none is implied by anything below. What exists instead is narrower and is in the code rather than in a paragraph: a draw the relay could not turn into a token goes back to your balance. Its edges — including what it cannot detect and therefore cannot refund — are under Availability below. |
| Timestamping and legal effect | ||
| eIDAS-qualified timestamp authority | ◇not refuted | Contracted since 24 September 2026: Microsec zrt., a qualified trust service provider on the Hungarian eIDAS trusted list (nmhh.hu, sequence 99), supplied under the annual agreement signed 24 September 2026 (5,000 qualified tokens a year). Every paid stamp asks it for a qualified token beside the two free ones, and the first production token drawn through this site verified offline against a key pinned from that list — signed by Microsec zrt., ECDSA/SHA-256, assurance qualified. That token carries the legal presumption under eIDAS Article 41; the two free authorities beside it — freetsa.org, a volunteer service, and timestamp.digicert.com, a courtesy endpoint for code-signing customers — are not qualified trust service providers, and no presumption may be implied from a token either one signs, by us or by anyone quoting us. Honest caveats, because this row is measured and not promised: the production credential under that agreement has been configured on this deployment since 24 September 2026; the unit that signs is not named on the trusted list as a unit — the supplier lists the issuing CA as the qualified service, which is how the list represents its time-stamping units, and the pin records that; and the engine also pins six of SK ID Solutions AS's units from the Estonian list (sr.riik.ee, sequence 73), so a second qualified authority can be added without a code change. The status page reports when the qualified leg last issued a token to this deployment, read from real draws — one nightly, one per paid stamp — and never assumes it; this row's face follows that reading (read from the status route at load). |
| More than one authority behind every stamp, paid or free | ◆produced | Two free legs are attempted on every stamp — and a qualified third where this deployment relays to one — and that is the honest word. The relay posts the same imprint to every leg at once and the record carries every token that came back — so a stamp closes on one token when another authority does not answer. The two free legs are never charged for; a paid stamp is charged the same however many answer: the meter draws once for the qualified token per stamp and once per renewal, never once per token. A two-token bracket survives an authority disappearing. A one-token bracket rests on that one signature, and the record says how many it holds. |
| We cannot alter or backdate your journal — and you can check that | ◆produced | Every night at 02:00 UTC every entry in every account's journal is folded into one Merkle root, yesterday's root is folded in with them, and the root is stamped through the same beacon and authorities as any stamp. The anchors are public (/api/anchors, the root's own .cts for any night); the path from your entry to the root is yours for the asking (/api/journal/{id}/proof), and your browser checks leaf, path, root and the root's stamp on your own device when you open a stamp. An entry, once anchored, exists in that form by that night's bracket, and a night's anchor cannot be replaced without the next one refuting it. Since 17 September 2026. What it does not do: grade your stamp (your browser does), or prove an entry is still there (a deletion leaves its leaf in past roots, which is the point). |
| Stamps that do not expire | ◆produced | A token is checkable only while its authority's key is pinned and unexpired (2038 for Microsec, 2040 for FreeTSA today). On a paid plan with stamps to draw, every stamp in the journal whose checkability lapses within a year is renewed by us — one more link on its renewal chain, a fresh qualified token over the content id and the prior links, one unit from the balance, re-checked with the engine before it is stored. Switched off on the account page if you would rather do it yourself on the desk; a trial is never charged. Nothing is due for years on today's pins; the job exists so that day is a non-event. |
| A qualified token added later, without re-stamping | ◆produced | A record carries more than one token. A closing edge bought next year still closes a bracket opened this year, so nothing already sealed has to be made again when the anchor set improves. |
| Verification without contacting the vendor | ◇not refuted | The reader checks a stamp on your device, against the published format, and reaches no server of ours. Test it with the network off — that is the only version of this claim worth anything, and it is the one we would rather you ran than believed. |
| Data protection | ||
| Customer files uploaded to us for stamping | ✕refuted | Files are hashed in the browser. On the desk, at the plot and in the checking tool the bytes never leave the device: what travels is a digest, and a digest cannot be read back into a document. |
| Any customer bytes at all on our storage | ◆produced | One place, and this page describes it two sections down: the hand-off mailbox. A grower's phone posts a sealed record into the mailbox a buyer opened, where it waits 1 to 30 days at that buyer's own choosing, 14 by default, stored as posted, in the clear. That is a store of customer evidence, held for a bounded time, and it is the reason the row above is written narrowly instead of as "nothing is ever held". |
| Data-processing agreement | ◆produced | Data-processing terms attach to the order. Protosonic is processor for the hand-off mailbox and for filing deployments, where you are the controller, and controller for the website, accounts and payments. |
| Named sub-processor list | ◆produced | Named with role and country under Sub-processors below, and in the privacy notice. |
| Retention schedule, surface by surface | ◆produced | Published per surface: hand-off deposits 14 days by default and 1 to 30 at the buyer's own choosing, the farmer's phone 90 days, the meter counts only. A revoked API key's row is kept on purpose, and that is not a retention we can shorten for you: the hash, the label and the hour it was retired stay on the account as the audit trail, and so that the same string can never be minted twice. What revocation deletes is the index that makes the key usable, so the key stops working at once. The row goes when the account is closed. |
| Record of processing, or a data map | ◆produced | The controller-and-processor table in the privacy notice is the map: every surface, who is responsible for it, where it is stored and for how long. |
| Exit and continuity | ||
| Proprietary format needed to read your records | ✕refuted | The envelope, the furniture profile and the conformance vectors are published. A third party can write a reader without asking us, and one already runs in your browser. |
| Source-code escrow agreement | ✕refuted | None. Escrow exists so a customer can still read its records after a vendor fails, and you can already read yours without anything of ours being released: the format, the furniture profile and the conformance vectors are published, and the reader runs on your device. Our server source is not published today — the terms reserve the software and the hosted service, all rights reserved. What is open is the format, which is the half you would have needed. |
| Migration or export tooling at exit | ✕refuted | None, because there is nothing to migrate. You already hold every record, in the open format, on your own storage, and a copy of a sealed record is the record. |
| Notice before the service is shut down | ◔not checked | 90 days is written under Continuity below — on this page and nowhere else. It is not in the terms, which reserve the right to change or withdraw free tools at any time and contain no shutdown clause at all. Read it as an intention the founder has published and has not yet put into a contract, because that is what it is. |
How to read the middle column. It answers the claim that we have the thing named on the left, and it uses the product's own grammar: ◆ produced is a thing that exists and was not judged, ◇ not refuted is a claim you can test that nothing has contradicted, ◔ not checked is a gap nobody has closed, and ✕ refuted is a plain no. None of them is a pass, here or anywhere else on this site. That is also why there is no column of ticks: a tick is a claim in a costume, and a row of them tells a reader nothing about who checked.
Paying, and exactly what the code does.
Two shapes, and the difference between them is most of this page. Four rungs and every block are bought through Stripe Checkout with nobody telephoned. A deployment is not bought that way at all, and what that means in practice is printed here rather than discovered in a fortnight.
A deployment, and what actually happens.
You scope it above and you get a band. If you want it, you send the scope you built. What comes back is a written scope: the entity, the headings, the origin countries, the sites, the filing runtimes, the rate card, a term and a price. Signed by both sides, that document is the binding one — and nothing on this page is, including the number the panel printed for you.
It is invoiced by transfer, outside this software. There is no checkout for it, no card, no direct debit, no subscription to cancel and no dunning: an invoice from Protosonic OÜ against a signed scope. Prices exclude VAT.
And the disclosure that costs us something to make. No code in this repository has ever invoiced a deployment, because none has been sold. The relay, the meter and the filing routes are built and tested; the commercial machinery around a deployment is a person, a document and a bank transfer. If you need a vendor whose enterprise billing is a running system rather than an intention, this is where you find that out — before signing, which is the only useful place to find it out.
The self-serve rungs, and the blocks.
Bought in the account, monthly or annually in advance, through a Stripe Checkout session. Prices exclude VAT; Stripe determines and adds it from your country and your VAT number, and Stripe issues the invoice. Nobody is telephoned to arrange any of it.
The 100,000 qualified stamps block at €22,900 is bought once and never expires. Being a one-off payment rather than a subscription, it is the one purchase Stripe raises a full invoice for by itself, and it renews nothing, duns nobody and cannot be cut off — often the fastest thing to get through a purchasing department, and it matches what you are buying: closing edges, held by you. Four of those carry one fully bracketed finished item, so a piece of furniture costs about 92 cents in evidence at that overflow rate. The block is dearer per stamp than a year on Works, and priced so that a rung topped up with blocks never beats the next rung: it is a purchase order, not a cheaper subscription.
A large operator can buy blocks and never read this page. That is not an oversight in the offer. If your scope does not need configuring against origin countries, sites you do not own and your own filing credentials, blocks are the cheaper and the faster purchase — and the form above says so itself, in place of the band, rather than leaving you to work it out.
- Supplier
- Protosonic OÜ, Estonia, trading as OpenStamps
- Registry code
- 16344167
- VAT number
- EE103014252
- Currency
- EUR. Prices exclude VAT; on the rungs Stripe determines and adds it
- The self-serve rungs
- card, through Stripe Checkout, in the account
- Blocks
- a one-off payment; Stripe raises the invoice by itself
- A deployment
- by transfer, against a signed written scope, outside this software
- Enquiries
- pilot@openstamps.com
Two live unknowns, since this page would rather be dull than wrong. No code in this repository has ever talked to Stripe — the billing function is built against the published API and tested against a fake, so the first real purchase is the first live test of it. And the meter still carries a subscription plan under this rung's name, which the account still lists. It is an allowance, not a deployment; buying it would not get you one; it is to be removed. Its figure is deliberately not reprinted here.
What is still not offered, so that nobody spends a fortnight discovering it. On the self-serve rungs: no negotiated discounts, no redlines, no master agreement of your drafting, no custom terms, no custom retention, no custom SLA. The terms are the same for everyone on the ladder, from the free trial to the top of it.
A deployment is scoped, and scoping is not negotiating. What moves in a written scope is the SCOPE — which entities, which headings, which origins, which sites, which term. The rate card does not move, and it is printed above where your competitors can read the same figures you were given. That is the difference between a price that follows the work and a price that follows how badly you need it by December, and it is why the form has no field asking when your board meets.
It is also why there is still no call to book, no calendar and no chat. A call can only settle a thing that is negotiable, and everything a first call would have settled — what it is, what it costs, what it does not include, whether you need it at all — is on this page, in writing, before you write to us.
What a deployment includes, and what it does not.
What it is.
- A configuration against your own problem — your HS headings, your countries of production and their legality stacks, your supplier sites, your record shapes and your product lines
- A filing runtime for each legal entity that submits in its own name, holding that entity's own EU Information System credentials and no other entity's
- The meter, at the rate card above, running beside the deployment for as long as it runs
- Seats, uncounted and unpriced, for as many people as the work needs
Two things that are not additions, said before somebody plans around them. The evidence is identical to the free trial's: the same envelope, the same two edges, the same published profile, the same offline reader, the same four floors. And a filing deployment is not exclusive to this rung — one can be scoped per legal entity on Studio, Works, Mill or Plant too, and on every rung the conformance record for the adapter is not on file yet. A deployment buys configuration, origin coverage and the work of standing it up. It does not buy a better stamp, and no amount of money on this page does.
What it does not include.
- No SLA of any kind, and no service credits — at any price on this page
- No named contact and no support response time
- No SAML and no SCIM — single sign-on with Google Workspace or Microsoft Entra ID (OpenID Connect) and teams on one balance are on every rung already; SAML and directory sync are not built, and when they are they will be free on every rung
- No private answers: the checklist above is the one every buyer gets, and it is public
- No better continuity promise than the free trial gets, for the reason set out at the foot of this page
- Everything a smaller rung gets is already here; nothing is withheld from them to make room for this
Why the meter costs what it costs, since the question is fair. Every stamp asks up to two free authorities at no charge, up to the daily limits — a bracket anchored to a single one is a bracket that ends when that authority does, and those two cost us nothing, so since 15 September 2026 they are not metered at all. What the meter counts is the qualified token a paid stamp adds beside them: one per stamp, from a trust service provider on the EU Trusted List, the token that carries the eIDAS Article 41 presumption, and the one line on a stamp with a supplier's invoice behind it. Renewing a stamp's timestamps is the same draw again — the meter draws once per stamp and once per renewal, never once per token, however many authorities answer either. The supplier's list runs about €0.044 a token at 5,000 a year, €0.040 at 10,000 and €0.025 at 100,000, so a qualified stamp costs roughly four euro cents at low volume and under three once volume arrives. The self-serve ladder runs 32.5, 28.4, 25.0, 20.8 and 17.9 cents an included qualified stamp by the month — Maker, Studio, Works, Mill, Plant — and 27.1, 23.7, 20.8, 17.4 and 14.9 by the year. Overflow blocks run from 33.0 down to 22.9 cents, above a year on Works, and are priced so that a rung topped up with blocks to the next rung's count always costs more than that rung: topping up is not a shortcut to the next. The deployment meter opens at 11.9 — below a year on Plant and cheaper than any self-serve block — and steps to 9.8, 8.9 and 8.4 as the year passes 100,000, one million and ten million qualified stamps — each band above what a token costs at the volume that reaches it.
And why the deployment is a second number rather than a bigger first one. The meter pays for tokens, and tokens scale with stamps. The deployment pays for the work that has to happen before a token is worth buying: an origin country's legality stack read and encoded, a supply base that does not work for you brought to the point of stamping, a filing runtime standing up under one entity's credentials. None of that scales with stamps, so charging for it per stamp would overcharge a high-volume operator with one origin and undercharge a low-volume one with fourteen. Two numbers, each following the thing that actually drives it, is the honest shape — and both are printed above rather than quoted in a room.
Four qualified stamps make one finished item at the production floor (F1), at the four events the furniture profile puts a floor under: harvest, work order, unit ordinal and filing hand-off. The plans page has the whole self-serve ladder, and it is worth reading before you scope anything here — most operators, including some large ones, do not need a deployment, and the form above will tell you so in place of a band.
Security, answered as an architecture.
We have no certificate to show you. What we have instead is a design in which the interesting thing is not here to be taken.
Files are hashed in the browser and never uploaded. The declared record, the photographs, the delivery notes — on the desk, at the plot and in the checking tool the bytes stay on the device that made them. What travels is a digest, and a digest cannot be read back into a document. Nothing on those three paths posts a file to us. One path does hold customer bytes, it is not an exception we would rather you missed, and it is the next paragraph.
Hand-off deposits and account workspaces have different storage rules. An account can store a workspace backup; that is not a shared team workspace. See the privacy notice for account data and retention. When a buyer asks a grower for a record, the grower's phone posts the sealed record into a mailbox we run for that buyer, where it waits to be collected. It is held for 1 to 30 days at the buyer's own choosing, 14 by default, and the request and everything in it are deleted on the next touch after expiry. Said plainly, because it matters: deposits are stored as posted, in the clear. "We do not read them" is a promise, not a lock, until deposits are encrypted to a key carried in the request link.
What else exists on our side is small and named. An account holds an e-mail address, a signed session cookie, the plan, the period's counts and the top-up balance. An API key is stored as a SHA-256 hash, never as the key, and a revoked key's row is kept as the audit trail. The meter keeps counts and nothing else — no record, no fingerprint, no content. Card, Revolut Pay and bank details are entered on Stripe's own hosted pages: we never see a card number, Revolut credentials or an IBAN, and no payment page is served from here.
One credential here is larger than everything above it, and it is not ours. A filing deployment holds the operator's own EU Information System credentials — the username and the Authentication Key — in the deployment's environment configuration. That is the credential that lets a due-diligence statement be submitted, amended or retracted in the operator's name, and it makes this server a party rather than a pipe: the timestamp relay forwards bytes it cannot forge, and this does not. It is never sent to a browser, never logged and never in a response body; every filing route is same-origin, rate-capped and reached only by a person pressing a button that says File. It is also why filing by API is off unless an operator asks for it: with no such variables set, every filing route answers 503 and the desk tells the operator to upload the downloaded statement in their own Information System account instead. The Commission's conformance test has not been recorded as passed for this deployment, and until it is, treat every filing result as acceptance-grade.
The surface-by-surface controller map, every retention window and every legal basis are in the privacy notice, which is written to be read by your data protection officer rather than by us. Vulnerability reports go to the address in /.well-known/security.txt. The format is public to attack before you sign, and we would rather hear it from you than from a customer.
Sub-processors.
Everyone who touches anything, with what they do and where they are. If this list changes, it changes here.
| Party | Role | Country |
|---|---|---|
| Netlify, Inc. | Hosting, CDN and the serverless functions that read and write the stores; holds no copy of the stored material since 16 September 2026 | United States, under EU Standard Contractual Clauses |
| Twilio, Inc., when configured | Delivers the buyer's request link to the phone at the plot by SMS or WhatsApp (an approved template), and answers a farmer who texts first with the field page's link. Receives the phone number, the buyer's name and the link, and carries the record files the person sends back over WhatsApp. Only where the deployment sets a provider | United States |
| Telegram FZ-LLC, LY Corporation (LINE), Rakuten Viber, Tencent (WeChat), VNG Corporation (Zalo) — each only when configured | A bot or an official account as a door for the person at the plot: the request link handed to them on a tap or a typed code, and the record files they send back carried to the buyer's mailbox. Each receives the chat and the files; the site keeps a keyed hash of the chat identity, never the identity. Only where the deployment sets the channel | United Arab Emirates (Telegram); Japan (LINE); Luxembourg/Japan (Viber); China (WeChat); Vietnam (Zalo) |
| Cloudflare, Inc. | Object storage with EU jurisdiction (R2) — the journal, the vault, the anchors, published journeys, desk bundles, the hand-off and co-presence mailboxes, the account record and the abuse counters. Bytes only; the functions that interpret them run on Netlify | European Union (bucket restricted to EU locations at creation); Cloudflare, Inc. under EU Standard Contractual Clauses for support access |
| Stripe Payments Europe, Ltd. | Payments, invoicing and VAT determination; holds the customer record. Stripe, Inc. is its own sub-processor | Ireland (Stripe, Inc.: United States) |
| Resend, when configured | Sends the one-time sign-in e-mail, and only that. It is named here because it is the only provider the account code can use — one implementation, chosen by an environment variable — and it becomes a sub-processor only on a deployment that has configured it, which is why the privacy notice holds the name until one does. Where it is not configured the account function answers 503 and no e-mail is sent | United States |
| FreeTSA | RFC 3161 timestamp authority for the closing edge. Receives a digest, never a file. A volunteer service, not a qualified trust service provider | Germany |
| DigiCert, Inc. | RFC 3161 timestamp authority for the closing edge. Receives a digest, never a file. A courtesy service for code-signing customers, not a qualified trust service provider | United States |
| Microsec zrt. | RFC 3161 qualified timestamp authority for the paid third leg. Receives a digest, never a file. A qualified trust service provider on the Hungarian trusted list (nmhh.hu, sequence 99) | Hungary |
drand is not on this list, and that is the point. The drand beacon is a public randomness source operated by the League of Entropy. It receives nothing from us and holds nothing of yours: the lower edge of a bracket is a round number that already existed before your bytes did. It is named here so that it is not filed as a sub-processor by somebody being careful, and so that nobody mistakes it for a service we could lose.
Thirty days' notice of any addition to this list, published on this page. There is nothing to subscribe to: the page is the notice, and the line below is how you check that it is current. Read it the way the continuity cards are meant to be read — it is an intention published here, not a clause in the terms or the privacy notice, and neither of those documents carries it today.
This list last changed on 5 September 2026.
Availability, split the way the product is built.
Three different things are usually bundled into one uptime number. They have genuinely different answers here, and not one of those answers is a percentage.
Checking and reading.
No SLA, because no server of ours is involved. A reader checks a stamp on the reader's own device, against the published format. Our being down cannot stop it. Neither can our being gone. There is no number we could promise here that would be as strong as the absence of a dependency.
The closing edge.
No SLA, because it depends on third parties. Closing a bracket means reaching independent timestamp authorities. We do not control their uptime and will not promise it with our name on it. What we will do is say exactly what happens when it fails, which is the next card.
What the meter gives back.
A draw the relay could not turn into a token goes back to your balance. The unit is taken before the call and returned when the authority does not answer with a usable token — a refusal, a timeout, a dropped connection, or a reply that carries a rejection instead of a token. It is a refund in the code, not a hope that the draw never landed, and nothing is queued behind it: the record still seals, one-sided, open at the top, honestly weaker, readable by everyone.
What the relay cannot see, it cannot give back. A token that leaves here well formed and is then refused by the reader on your device is charged. So is a stamp that closed on one authority when the second did not answer — one stamp, one draw, either way. And a refund landing after your month has rolled returns the top-up part in full but the included part only as far as the new month has been used, so a very late one is smaller. No SLA sits behind any of this, and none is implied.
A 99.9% figure is a number a vendor writes about itself, settled by a support ticket months later against credits you have to ask for. What is above is smaller than that promise and it is a behaviour you can watch in your own balance on the day it happens, including the parts of it that do not go your way. Narrower and real is the trade, and it is the one we would rather be judged on than a paragraph.
Continuity, and why it is not a tier.
Three intentions about the day we are not here. They are the same on every plan, including the free one — and they are written on this page and in no contract, which is the first thing to say about them.
Read all three as ◔ not-checked. None of them is in the terms, which carry no shutdown clause and reserve the right to change or withdraw free tools at any time. Nobody has established them, no auditor has seen them and no clause obliges us to keep them. They are what the founder intends and has published so it can be quoted back; a page that dressed them as terms would be selling exactly the kind of promise this product exists to replace. The one continuity promise that is a term is in § 6: every stamp already made stays checkable by anyone, permanently, after we stop selling and after we stop existing — and it costs nothing to keep, because checking never touched a server of ours.
◔not checked
Ninety days' notice.
The intention: if the service is to be shut down, notice is published here and sent to every account 90 days before it happens. Not thirty, and not a redirect to a holding page one morning. Not in the terms today.
◔not checked
The server halves, at shutdown.
The intention: at shutdown the two halves a static site cannot supply — the timestamp relay and the meter — are released under an open licence, so anyone can keep closing brackets. They are closed source today and the terms reserve them.
◔not checked
Mirrored, not hosted.
The intention: the specification, the reader, the test vectors and the conformance pack are mirrored to independent archives, so they outlive the domain, the company and this page. No mirror is named here yet, because none has been arranged.
What escrow is for, you already have; what escrow releases, we have not released. Escrow exists so a customer can go on reading its records after a vendor fails — and you can, without anything of ours changing hands: the format, the furniture profile, the record shapes and the conformance vectors are published under documented licences, and the reader runs on your device against the bytes in your own storage. Our server source is not published, and the card above is an intention rather than a release. That is the honest version, and it is still the reason there is nothing to sign: the half an escrow agreement exists to reach you already reached you.
Whatever these are worth, they are worth it to every rung and not to this one. A deployment buys configuration, origin coverage, filing runtimes and the work of standing it up. It does not buy a better promise about what happens when we are gone — because a continuity clause you can buy is a continuity clause somebody else can be denied, and a thing that can be denied is a thing that gets negotiated. This model exists to make that conversation unnecessary. Putting a price on the exit would put it straight back, and writing these three into a scope for you alone would be the same move wearing a lawyer's coat. They stand here for a free trial and for a twenty-country estate on identical terms, which is to say on none.